By default, ActionTrail provides access to the last 90 days of event history. To meet compliance requirements that mandate longer retention periods, such as 180 days, you can create a data backfill task. A backfill task delivers historical events from the last 90 days to a Simple Log Service (SLS) Logstore for long-term storage and analysis.
Prerequisites
Simple Log Service (SLS) is activated. If you have not used SLS before, log on to the SLS console and follow the prompts to activate the service.
The backfill feature is enabled for your account. To enable this feature, submit a ticket.
Background information
An ActionTrail trail only delivers events that occur after it is created. To capture events that occurred before the trail was created, you must use a data backfill task.
A backfill task can deliver events from as early as 90 days in the past up to the point when its associated trail was created. For example, if you create a trail today and then create a backfill task for it, the task will deliver the last 90 days of historical events to the trail's destination.
Data backfill is supported only for single-account trails that deliver events to SLS.
Only one backfill task can run at a time in your account.
Step 1: Create a single-account trail
First, create a trail that will receive the historical events. The trail must be a single-account trail that delivers events to an SLS Logstore.
Log on to the ActionTrail console.
In the left-side navigation pane, click Trails.
From the region selector in the top navigation bar, select the region where you want to create the trail. This becomes the trail's home region.
On the Trails page, click Create Trail.
On the Create Trail page, configure the trail. Ensure that you specify the following settings:
Under Basic Information, provide a Trail Name and ensure that Read/Write Type of management events is set to All.
Under Event Delivery, select Delivery to Simple Log Service and specify a new or existing SLS project as the destination.
For more information on other settings, see Create a single-account trail.
Click Confirm.
Step 2: Create a data backfill task
In the left-side navigation pane, click Backfill.
From the region selector in the top navigation bar, select the home region of the trail you created in Step 1.
On the Backfill page, click Create Task.
On the Create Task page, select the trail you created from the dropdown list.
NoteThe console automatically populates the destination SLS project and Logstore information based on the selected trail.
Click Confirm.
After you create the task, you can monitor its progress on the Backfill page. The Delivery Status column shows whether the task is running, completed, or has failed.
Step 3: Query the backfilled events (Optional)
After the backfill task is complete, you can query the historical events in the destination SLS Logstore.
In the left-side navigation pane, click Trails.
In the top navigation bar, select your single-account trail's home region.
On the Trails page, find the trail you created and, in the Storage Service column, click the name of the destination Logstore. You will be redirected to the SLS console.
In the upper-right corner of the query pane, select a time range.
Enter a search query or an SQL statement and click Search & Analyze.
References
For more information about how to query and analyze event data, see Query and analyze logs.
For more information about the SQL statements that can be used to query and analyze events, see Query ActionTrail events in SLS using SQL statements.
For troubleshooting, see FAQ about query and analysis.